Argus: an MIT-licensed security platform where agents only propose

On 24 October 2026 a developer posted Argus to Hacker News as an open-source platform to protect against agentic attacks. According to the project's GitHub README, it is a self-hosted, multi-tenant security operations platform under the MIT licence that watches cloud, identity, code, endpoints, network and Kubernetes, and uses AI agents to investigate what it finds. The thread drew 17 points and 4 comments.

How the README says it limits the agents

The README describes seven specialist agents that triage, investigate and hunt using read-only tools. Their one write-capable tool creates a pending request, which goes to an action broker with its own policy, approvals, dry run, rollback and kill switch. The broker's catalog has 27 typed actions across AWS, Azure, Google Cloud, Kubernetes, GitHub, Okta, Entra, Cloudflare, CrowdStrike and SentinelOne.

The README adds that everything an agent reads is wrapped as untrusted data, so a prompt injection hidden in a log is meant to become a signal rather than a hijack. Agent providers are Anthropic, OpenAI and Ollama.

Autonomous response and the AI gateway

Separate from the agents, the README describes response playbooks that act when a detection fires, such as blocking an attacker at Cloudflare or isolating a laptop through CrowdStrike or SentinelOne. It says they start in shadow mode, use only reversible actions, stay within hourly and blast-radius caps, and roll back unless someone keeps the change. Approve, deny and roll back buttons appear in Slack. Autonomous features, including the AI gateway, are described as off by default.

The gateway is a proxy for OpenAI and Anthropic traffic with company-held keys, model allowlists, data-loss prevention, prompt-injection flags and budgets. The README says shadow-AI discovery uses network, cloud and sign-in telemetry to find AI services nobody approved. It also describes canaries aimed at agents (a planted prompt injection, an agent rules file, a fake MCP server and fake LLM API keys) and a simulator that replays 8 agent-driven attack scenarios in a sandbox tenant.

What it costs and how it was tested

The README states no price: it is MIT licensed and self-hosted, so the costs are your servers, any model API charges and the effort to run it. It deploys with Docker Compose, Helm or Terraform for AWS and Azure. The author says more than 460 automated tests run on every commit against SQLite and PostgreSQL, alongside Bandit and pip-audit scans. The README gives no customer names, detection-quality figures or independent audit.

What commenters pushed on

• One commenter, montyanne, rejected the project's opening claim that its agents "analyze evidence but never act on the estate" and called it a repository of meaningless systems; they gave no technical detail.
• Another, whatdowecallu, replied by asking whether people want agents taking action without approval in security, which is the question the README's approval-first design answers.
• Two other comments were brief praise.

What is not known

The README does not say how much of the code was written with AI, how many people maintain it, or how it performs on real incidents. The statement that agents never act sits beside playbooks that act without a human; the README separates the two, but a reader should verify that separation in the code and the threat model it points to.

What to do

• If you are evaluating an AI security product, ask whether the model can call execution tools directly or only file a request that a separate policy layer approves.
• If you try Argus, follow the README's own order: monitoring mode first, shadow-mode playbooks next, and no autonomy until the dry-run output matches what your team would have done.
• Ask for evidence beyond the README, such as the threat model, test results and an outside review, before connecting it to production credentials.